#sast

AI-native CWE (Common Weakness Enumeration) integration layer — Skills, Go SDK, CLI & MCP. Ship CVE/CWE tooling to SAST/DAST, vuln-management & AI agents.

AI-powered triage for SAST findings.

Security scanner for AI agent skills and MCP servers. Detects secrets, CVEs, supply chain attacks, and prompt injection in SKILL.md files before they're installed. Pre-install gate for Claude Code, OpenClaw, PicoClaw, NanoBot, FamClaw, and CI/CD pipelines. Single Go binary, MIT licensed.

Deterministic security & quality gate engine for git repos. Installs pre-commit/pre-push hooks that run secret scanning (gitleaks), SAST (semgrep/OWASP), linting (ruff/eslint), type checks, dependency audits, and tests — security findings block, quality issues warn. Event-sourced findings ledger, one-command setup: aramid init <repo>.

Static analysis scanner for multi-tenant SaaS and MCP server code. 57 deterministic rules for cross-tenant data leakage, IDOR, RLS, and MCP-specific risks. Includes MCP server, SARIF output, and GitHub Action.

Find authorization bugs before attackers do. Free SAST — IDOR detection, 100% CVE recall, 0% false positives. 5 languages. Fully offline.

CI/CD pipeline security analyzer — scans GitHub Actions workflows for attack vectors and maps findings to MITRE ATT&CK

local-first security analysis for TypeScript & JavaScript

The Silent Observer — Fast, local-first security scanner for dependencies (SCA), exposed secrets & git history, SAST, Dockerfiles, and GitHub Actions with multi-provider AI remediation.

CLI & Agent plugin for fetching SAST rule packs from greprules.io and scanning local code changes.

Nation-state grade, defense-in-depth security testing framework. Tests web apps, extensions, desktop, mobile, cloud, AI/LLM, hardware, and supply chain from a single CLI.